Splunk Search

Grouping events by time within some milliseconds

TBo123
Path Finder

Hello there,

I hope there is someone who can help me. I want to group events that occur within some milliseconds. I tried the transaction command to solve this problem but the minimum of maxpause seems to be 1s. So I don't know how to get rid of this problem. Perhaps there is another solution..

The aim is to get tuples of events that occur within some time interval.

Thanks.

0 Karma
1 Solution

TBo123
Path Finder

I find a way to solve my problem.

I generate IDs for the events which should be grouping by this way:

First I used the delta command to get the difference "diff" between two Events then there is a chance to differ in ms

my base search | delta _time p=1 AS diff | eval ID=case(isnull(diff),1,diff>0.001,1,1=1,0) | accum ID

The result is a new field called ID which show the same ID for Events that occur within some milliseconds.

Thanks to somesoni2 who helped me solve this problem..

View solution in original post

0 Karma

TBo123
Path Finder

I already tried bucket, but it was not the way I am looking for..

0 Karma

TBo123
Path Finder

I find a way to solve my problem.

I generate IDs for the events which should be grouping by this way:

First I used the delta command to get the difference "diff" between two Events then there is a chance to differ in ms

my base search | delta _time p=1 AS diff | eval ID=case(isnull(diff),1,diff>0.001,1,1=1,0) | accum ID

The result is a new field called ID which show the same ID for Events that occur within some milliseconds.

Thanks to somesoni2 who helped me solve this problem..

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Depending on your use case, bucket may be of help:

base search | bucket _time span=25ms | stats something something by _time
0 Karma

somesoni2
Revered Legend

You may try to use "streamstats" command to get the timestamp of previous event and calculate the duration from it. You can then group events with smaller duration. Something like this

your base search | streamstats current=f window=1 first(_time) as prevTime | eval duration=_time | eval shouldGroup=if(duration < yourMinduration,"Y","N") ....

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...